The present invention relates to the field of online computer security. In particular, the present invention provides a system and process for maintaining a database of information and characteristics about specific web sites, particularly the web sites of financial institutions, to facilitate more secure authentication of selected web sites and to protect against “phishing” and “pharming” attacks. The process allows user/clients to utilize the information and characteristics stored in the website database to help to validate the identity of the website before passing sensitive information to the website such as authentication credentials. The present invention allows user/clients of multiple online services to periodically receive updated information about selected websites.
Wide spread use of the Internet for electronic transactions has resulted in the need for specific and secure identification of a user, or client, who wishes to connect with a particular website server so that business may be conducted by the user/client, or so that the user/client may access confidential information which the user/client is authorized to obtain. Common instances of the most simple form of this type of transaction are user/client interactions with a bank server for the transaction of business with the bank or for obtaining information regarding the user/client accounts. Other such instances are user/client interactions with medical providers or insurance companies or government agencies where confidential information related to the user/client is maintained. Also, user/client interactions with Internet businesses for the execution of electronic commerce transactions represents a situation in which the merchant may employ an authenticating algorithm to speed the process of identification of users of the site.
Cyber criminals use two different types of attacks to steal user/client confidential authentication information (e.g. user name and password): “phishing” and “pharming”. In phishing (pronounced “fishing”) attacks, cyber criminals send out a wave of spam email, sometimes up to millions of messages. Each email contains a message that appears to come from a well-known and trusted company (i.e. bank or other financial institution). The message urges the recipient to click on a link provided in the mail. Upon clicking on the link provided in the phishing email, the user/client is presented an authentic-looking, but actually bogus web site which asks the user/client to enter his/her confidential authentication information, that is, usernames, passwords, etc.
Pharming (pronounced “farming”) is another form of online fraud. Pharmers rely upon the same bogus web sites and theft of confidential information to perpetrate online scams, but are more difficult to detect because they do not rely upon the victim accepting a “bait” message. Instead of relying on users clicking on an enticing link in fake email messages, pharming instead use an attack called DNS (domain name server) cache poisoning to redirect victims to the bogus web site even if they type the right web address of their bank or other online service into their web browser. Domain name servers are often associated with Internet service providers (ISP's) and function to convert calls to URL's (uniform resource locators), such as the form www.website.com, to numeric IP (Internet protocol) addresses for their subscribers. In DNS cache poisoning, the correspondence between one or more selected URL's and their IP addresses is corrupted to redirect calls to the selected URL's to IP addresses of servers controlled by the pharmers.
There have been attempts to develop tools to help users/clients detect and avoid pharming and phishing attacks. One scheme is to maintain and update a “blacklist” of known web sites used in past phishing attacks, which cannot be used to protect against pharming attacks. FIG. 1 illustrates how this a blacklist scheme works. An email 201 with an embedded URL has the URL compared at 203 with a blacklist of known phishing URL's. If the comparison is a match at 205, the web site is probably a phishing site. If no match at 205 occurs, the web site in question may or may not be a phishing site. In actual practice, blacklist tools are not very effective against phishing attacks because cyber criminals routinely change the URL in their phishing emails on a daily or even hourly basis. As a result of this weakness, blacklist anti-phishing solutions are usually combined with “heuristic” algorithms which attempt to monitor every web site visited by the user/client and determine, based on characteristics of the web site whether that site might be a bogus phishing or pharming site. Heuristic algorithms often make use of artificial intelligence techniques.
In order to be effective, heuristic algorithms must look at every web page visited by the user. Heuristic algorithms typically look at characteristics of the web page together with the web site URL and IP address and attempt to rank the security risk of the web page. FIG. 2 illustrates the operation of a heuristic algorithm. The email 210 with an embedded URL is processed, and the web site specified is downloaded at 212 and analyzed by the heuristic algorithm at 214. If a match occurs at 216, the web'site may be a phishing site, but the result is inconclusive. If no match occurs at 216, the web site may not be a phishing site, but again the test is not conclusive. Heuristic algorithms are almost impossible to test and typically result in both false positive and false negative results.
Another approach which attempts to address the phishing/pharming problem is to maintain a “whitelist” database of known good websites, such as the URL's of such sites and compares these with any web page with which access is attempted. Some whitelist approaches test other characteristics of web sites, such as IP addresses, digital signatures, and the like. Whitelist authentication processes cannot typically provide protection against pharming sites and, in general, are not very effective as a sole means of secure web site authentication.
All of the methods described above to guard end-users against phishing and pharming attacks suffer from two problems: such methods are designed to provide the end-user with a security warning within a standard, open web browser program, such as MICROSOFT INTERNET EXPLORER, NETSCAPE, MOZILLA FIREFOX, or the like. In many cases, end-users don't recognize or notice such security warnings when given. Additionally, such methods work within standard web 2093198,1 5 browser programs. Standard web browser programs have open interfaces and are therefore vulnerable to malicious software plug-ins which can compromise an end-user's security.